Resubmissions
28/04/2026, 13:11
260428-qe8awahz7y1027/04/2026, 22:40
260427-2lta3saw2t1027/04/2026, 20:53
260427-zphyeahx9w10Analysis
- max time kernel
145s - max time network
147s - platform
ubuntu-18.04_amd64 - resource
ubuntu1804-amd64-20260126-en - resource tags
arch:amd64arch:i386image:ubuntu1804-amd64-20260126-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system - submitted
27/04/2026, 20:53
Behavioral task
behavioral1
Sample
vaxstresser.x86.elf
Resource
ubuntu1804-amd64-20260126-en
ubuntu-18.04-amd64
5 signatures
150 seconds
General
- Target vaxstresser.x86.elf
- Size 38KB
- Sample260427-zphyeahx9w
- SHA256 a22f6eda1ca12a99e36053dc09e866d8bef715331049a24139f041167f764a1d
- MD5 6737931339d3a38ab67fb2aba198bbdc
- SHA1 0cfc9ee62d018e21e92771186e9e1e47b6702ee3
- SHA512 b88a640f58572aa58744f787ff14c9f0e1c539ebc8e9e7a3720cd2eb417eacdf88db420e5333d213e528ec6f9576b8cd526895ab679d0b6fb1c91577703c7fba
- SSDEEP 768:qXyZ9boRkEz8+RYgMAKusWxnqpCRivcD66WAEIhX3ChOmrAR++43woN39eCk+9KU:qYmkC8+WrfW8pEivrVhEXShXrAR++43T
- TLSH T12903F104C58AA469F0177336417B7ACB4C16DB5EC1F88BC61EE4FC767685F642E242CA
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Malware Config
Signatures
- Modifies Watchdog functionality 1 TTPs 2 IoCs
Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
description ioc Process File opened for modification /dev/watchdog vaxstresser.x86.elf File opened for modification /dev/misc/watchdog vaxstresser.x86.elf - Enumerates running processes
Discovers information about currently running processes on the system
- Writes file to system bin folder 2 IoCs
description ioc Process File opened for modification /sbin/watchdog vaxstresser.x86.elf File opened for modification /bin/watchdog vaxstresser.x86.elf -
description ioc Process File opened for reading /proc/13/status vaxstresser.x86.elf File opened for reading /proc/29/status vaxstresser.x86.elf File opened for reading /proc/79/status vaxstresser.x86.elf File opened for reading /proc/164/status vaxstresser.x86.elf File opened for reading /proc/416/status vaxstresser.x86.elf File opened for reading /proc/971/status vaxstresser.x86.elf File opened for reading /proc/992/status vaxstresser.x86.elf File opened for reading /proc/1054/status vaxstresser.x86.elf File opened for reading /proc/36/status vaxstresser.x86.elf File opened for reading /proc/78/status vaxstresser.x86.elf File opened for reading /proc/160/status vaxstresser.x86.elf File opened for reading /proc/650/status vaxstresser.x86.elf File opened for reading /proc/693/status vaxstresser.x86.elf File opened for reading /proc/1032/status vaxstresser.x86.elf File opened for reading /proc/1075/status vaxstresser.x86.elf File opened for reading /proc/1092/status vaxstresser.x86.elf File opened for reading /proc/7/status vaxstresser.x86.elf File opened for reading /proc/174/status vaxstresser.x86.elf File opened for reading /proc/178/status vaxstresser.x86.elf File opened for reading /proc/490/status vaxstresser.x86.elf File opened for reading /proc/526/status vaxstresser.x86.elf File opened for reading /proc/1036/status vaxstresser.x86.elf File opened for reading /proc/1087/status vaxstresser.x86.elf File opened for reading /proc/1196/status vaxstresser.x86.elf File opened for reading /proc/20/status vaxstresser.x86.elf File opened for reading /proc/115/status vaxstresser.x86.elf File opened for reading /proc/321/status vaxstresser.x86.elf File opened for reading /proc/453/status vaxstresser.x86.elf File opened for reading /proc/1057/status vaxstresser.x86.elf File opened for reading /proc/1521/status vaxstresser.x86.elf File opened for reading /proc/137/status vaxstresser.x86.elf File opened for reading /proc/162/status vaxstresser.x86.elf File opened for reading /proc/1040/status vaxstresser.x86.elf File opened for reading /proc/1162/status vaxstresser.x86.elf File opened for reading /proc/1208/status vaxstresser.x86.elf File opened for reading /proc/1489/status vaxstresser.x86.elf File opened for reading /proc/166/status vaxstresser.x86.elf File opened for reading /proc/951/status vaxstresser.x86.elf File opened for reading /proc/978/status vaxstresser.x86.elf File opened for reading /proc/1093/status vaxstresser.x86.elf File opened for reading /proc/80/status vaxstresser.x86.elf File opened for reading /proc/417/status vaxstresser.x86.elf File opened for reading /proc/433/status vaxstresser.x86.elf File opened for reading /proc/496/status vaxstresser.x86.elf File opened for reading /proc/1097/status vaxstresser.x86.elf File opened for reading /proc/1179/status vaxstresser.x86.elf File opened for reading /proc/3/status vaxstresser.x86.elf File opened for reading /proc/10/status vaxstresser.x86.elf File opened for reading /proc/15/status vaxstresser.x86.elf File opened for reading /proc/161/status vaxstresser.x86.elf File opened for reading /proc/1273/status vaxstresser.x86.elf File opened for reading /proc/1069/status vaxstresser.x86.elf File opened for reading /proc/83/status vaxstresser.x86.elf File opened for reading /proc/414/status vaxstresser.x86.elf File opened for reading /proc/479/status vaxstresser.x86.elf File opened for reading /proc/676/status vaxstresser.x86.elf File opened for reading /proc/1/status vaxstresser.x86.elf File opened for reading /proc/14/status vaxstresser.x86.elf File opened for reading /proc/172/status vaxstresser.x86.elf File opened for reading /proc/909/status vaxstresser.x86.elf File opened for reading /proc/1383/status vaxstresser.x86.elf File opened for reading /proc/4/status vaxstresser.x86.elf File opened for reading /proc/18/status vaxstresser.x86.elf File opened for reading /proc/22/status vaxstresser.x86.elf